[BUG] sound/usb: out-of-bounds in prepare_playback_urb()

[BUG] sound/usb: out-of-bounds in prepare_playback_urb()

[co]

This is a bug report, not a patch submission.

We found a bug reachable in:

    path    sound/usb/endpoint.c` (the overwrite) and `sound/usb
    crash   out-of-bounds in prepare_playback_urb()
    commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you fix this bug, this tag credits the report and lets us
    close it on our side:

Reported-by: co+8eacd4fa193b1b28@bugs.sh

    Everything in this mail is validated by the reproducer below.

    We also hold an unreviewed LLM-generated analysis and candidate
    patch. The same reproducer panics the unpatched kernel and runs
    clean with that patch applied. Use it as a starting point, or ignore
    it and write your own:

        patch.diff  https://bugs.sh/b/8eacd4fa193b1b28/patch.diff
        report.md   https://bugs.sh/b/8eacd4fa193b1b28/report.md

    A guide to taking it from here to a sendable patch, including the
    trailers to add: https://bugs.sh/patch.html

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@bugs.sh

== Environment =========================================================
    Reproduced on  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
    VM setup       https://bugs.sh/b/8eacd4fa193b1b28/run.sh
    config         https://bugs.sh/b/8eacd4fa193b1b28/config.gz
    poc            https://bugs.sh/b/8eacd4fa193b1b28/repro.c

== Sanitizer Report ====================================================
BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)
Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178
CPU: 1 UID: 0 PID: 178 Comm: vhci_rx Not tainted 7.2.0-rc7+ #15 PREEMPT(lazy)
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
prepare_playback_urb (sound/usb/pcm.c:1560)
prepare_outbound_urb (sound/usb/endpoint.c:340)
snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)
snd_complete_urb (sound/usb/endpoint.c:1834 sound/usb/endpoint.c:269 sound/usb/endpoint.c:587)
__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)
usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)
vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 (discriminator 1) drivers/usb/usbip/vhci_rx.c:242 (discriminator 1) drivers/usb/usbip/vhci_rx.c:265 (discriminator 1))
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 174:
The buggy address belongs to the object at ffff88801e696a00
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 0 bytes to the right of
allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)
The buggy address belongs to the physical page:
Memory state around the buggy address:
ffff88801e696980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801e696a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88801e696a80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
^
ffff88801e696b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801e696b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@bugs.sh

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup

Re: [BUG] sound/usb: out-of-bounds in prepare_playback_urb()

[Takashi Iwai]

On Sat, 12 Sep 2026 04:09:23 +0200,
co wrote:
> 
> This is a bug report, not a patch submission.
> 
> We found a bug reachable in:
> 
>     path    sound/usb/endpoint.c` (the overwrite) and `sound/usb
>     crash   out-of-bounds in prepare_playback_urb()
>     commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you fix this bug, this tag credits the report and lets us
>     close it on our side:
> 
> Reported-by: co+8eacd4fa193b1b28@bugs.sh
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an unreviewed LLM-generated analysis and candidate
>     patch. The same reproducer panics the unpatched kernel and runs
>     clean with that patch applied. Use it as a starting point, or ignore
>     it and write your own:
> 
>         patch.diff  https://bugs.sh/b/8eacd4fa193b1b28/patch.diff
>         report.md   https://bugs.sh/b/8eacd4fa193b1b28/report.md
> 
>     A guide to taking it from here to a sendable patch, including the
>     trailers to add: https://bugs.sh/patch.html
> 
>     Happy to test patches. Complaints and suggestions about our work
>     are welcome at:
> 
>         cedalion@bugs.sh

The suggested patch looks reasonable.  Could you just submit it in a
proper format for upstream (after verifying that the issue still
happens in the latest upstream)?


thanks,

Takashi

Re: [BUG] sound/usb: out-of-bounds in prepare_playback_urb()

[Xiang Mei]

On Sat, Sep 12, 2026 at 9:31 AM Takashi Iwai <tiwai@suse.de> wrote:
>
> On Sat, 12 Sep 2026 04:09:23 +0200,
> co wrote:
> >
> > This is a bug report, not a patch submission.
> >
> > We found a bug reachable in:
> >
> >     path    sound/usb/endpoint.c` (the overwrite) and `sound/usb
> >     crash   out-of-bounds in prepare_playback_urb()
> >     commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
> >
> > Config, environment, the sanitizer report and a C reproducer follow.
> >
> > == Notes ===============================================================
> >     If you fix this bug, this tag credits the report and lets us
> >     close it on our side:
> >
> > Reported-by: co+8eacd4fa193b1b28@bugs.sh
> >
> >     Everything in this mail is validated by the reproducer below.
> >
> >     We also hold an unreviewed LLM-generated analysis and candidate
> >     patch. The same reproducer panics the unpatched kernel and runs
> >     clean with that patch applied. Use it as a starting point, or ignore
> >     it and write your own:
> >
> >         patch.diff  https://bugs.sh/b/8eacd4fa193b1b28/patch.diff
> >         report.md   https://bugs.sh/b/8eacd4fa193b1b28/report.md
> >
> >     A guide to taking it from here to a sendable patch, including the
> >     trailers to add: https://bugs.sh/patch.html
> >
> >     Happy to test patches. Complaints and suggestions about our work
> >     are welcome at:
> >
> >         cedalion@bugs.sh
>
> The suggested patch looks reasonable.  Could you just submit it in a
> proper format for upstream (after verifying that the issue still
> happens in the latest upstream)?
>
Thanks for checking.
The patch has been tested on the latest upstream (tiwai/sound.git).

And I have checked related functionality and ensured the patch fixes
the bug (to my knowledge):
https://lore.kernel.org/linux-sound/20260912200530.1955491-1-xmei5@asu.edu/T/#u

Xiang


> thanks,
>
> Takashi
>